Privacy Policy

1. Controller

Daniel Rau
trading as BoothDock
Sole proprietorship, side business (Einzelunternehmen im Nebenerwerb)
Small business scheme under § 19 UStG (German VAT Act)
Herrweg 7
52511 Geilenkirchen
Germany

Contact for privacy inquiries: support@boothdock.eu
Phone: +49 2451 9017128

No data protection officer has currently been appointed. Privacy inquiries can be sent directly to the contact address above.

2. Scope and roles

This privacy notice applies to the website at boothdock.eu, to demo and support contacts, and to the planned BoothDock product architecture comprising BoothDock Studio, BoothDock Hub at https://boothdock.cloud and BoothDock Gallery.

For the website, demo requests, operator accounts, license management, support and billing, BoothDock acts as the data controller. For event, customer, guest and media data that photo booth operators have processed in the Hub, in Studio or in Gallery, BoothDock generally acts as a data processor. The respective photo booth operator remains the controller towards guests, event customers and other data subjects. A data processing agreement (DPA) under Art. 28 GDPR is intended to be put in place with operators for this purpose.

For this processor relationship, a data processing agreement, an overview of the sub-processors used, and technical and organizational measures are planned before productive use.

3. Principles of processing

BoothDock is being built around the principles of purpose limitation, data minimization, access restriction, storage limitation and confidentiality. Private gallery links, role-based permissions, deletion periods and traceable upload/sync status are part of the target architecture.

Photos and videos may contain personal data and, in individual cases, may reveal special categories of personal data. BoothDock does not analyze such characteristics automatically, does not perform facial recognition and does not create guest profiling.

If operators process event media from which special categories of personal data under Art. 9 GDPR may be inferred, operators must assess the appropriate legal basis, provide notice at the event, and establish their own consent and deletion processes. BoothDock provides the technical platform for this purpose and does not evaluate such characteristics.

4. Website and server logs

When the website is accessed, technically necessary connection data is processed. This can include IP address, date and time of access, requested file, HTTP status, amount of data transferred, referrer, and browser and operating system information.

The purpose is secure operation, error analysis and protection against misuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the stable and secure operation of the website. The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

The marketing website does not use marketing cookies. A contact form is embedded on the home page; section 6 describes which data this processes.

For anonymous traffic measurement, the self-hosted, open-source web analytics service Umami is used (operated on our own infrastructure at stats.boothdock.eu, no data shared with third parties). The same cookieless traffic measurement runs in the same way in the BoothDock Hub (boothdock.cloud). Umami works entirely without cookies: no cookies are set, no cross-device recognition takes place, and no profiles are built about individual visitors. Aggregated values are collected, such as pages viewed, referrer, country/region roughly derived from the IP address, and browser and device type. The IP address is processed only transiently to derive the approximate location and is not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage to improve the offering). Because no tracking cookie is set and no cross-device recognition takes place, separate consent under § 25 TDDDG is, in the prevailing view, not required.

In addition, and only with your consent, we use Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity records how this website is used – mouse movement, scrolling, clicks, pages viewed, browser and device type, and the IP address – and produces replays of individual sessions as well as aggregated views such as heatmaps. The sole purpose is to find usability problems, for example at which point of a form visitors give up. According to Microsoft, input in form fields is masked by default. Clarity sets two cookies (_clck, lifetime up to one year; _clsk, lifetime one day) and transfers data to Microsoft, including to the USA. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Without consent Clarity is not loaded, and no transfer takes place. You can withdraw your consent at any time with effect for the future, via the "Cookie settings" link at the bottom of the page. Further information is available in Microsoft's privacy statement.

5. Cookies and local storage

Non-essential cookies are only set on the marketing website after your explicit consent. On your first visit a notice appears with equally weighted buttons for accepting and declining; without acceptance, no service that sets such cookies is loaded. Currently this concerns only the session recording with Microsoft Clarity described in section 4 (cookies _clck and _clsk). The anonymous analytics with Umami still sets no cookies and runs regardless of this decision. Your decision is stored locally in your browser and can be changed at any time via "Cookie settings" at the bottom of the page.

On the marketing website a technically necessary session cookie is set for the contact form (protection against abusive submission, CSRF protection); it holds no message content and is not used for recognition. In the BoothDock Hub and in private galleries, technically necessary cookies or comparable storage technologies may be used, for example for login sessions, security functions, CSRF protection, language settings, or to provide a service explicitly requested by the user. The legal bases are Art. 6(1)(b) or (f) GDPR and, where applicable, § 25(2) TDDDG.

6. Demo requests, email and support

When contacted by email, contact form or support chat, the information submitted is processed. This can include name, company, website, phone number, email address, number of photo booths, typical events, technical questions and message content.

The purposes are handling the inquiry, demo preparation, communication, quotation and pre-contractual measures. The legal bases are Art. 6(1)(b) GDPR for pre-contractual or contractual inquiries and Art. 6(1)(f) GDPR for general communication and following up on legitimate inquiries.

The contact form and the support chat are protected against automated abuse by Cloudflare Turnstile (bot detection without a classic captcha), a hidden honeypot field, a minimum fill time, and a session rate limit; see section 11 regarding Cloudflare as a recipient.

Contact inquiries are deleted once they are no longer required for processing, unless statutory retention obligations, contract documentation or legitimate interests require further retention.

Demo requests can also be sent to mail@boothdock.eu.

7. Operator accounts and BoothDock Hub

In the BoothDock Hub, account, contract and usage data will likely be processed for operators and team members. This can include name, email address, company, role/permissions, login data, security events, license status, booked packages, settings, customer and event data, and technical log data.

The purposes are providing the Hub, authentication, role and permission management, event preparation, synchronization, support, operational security, license management and billing. The legal bases are Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for legal obligations, and Art. 6(1)(f) GDPR for security, misuse detection and product operation.

8. BoothDock Studio at the event PC

BoothDock Studio is designed as a desktop app for the event PC. There, photos, videos, session data, print data, gallery index, upload queues, camera/printer status, error messages and sync status can be processed locally.

Where Studio synchronizes data with the Hub, this occurs to perform the operator agreement and, for event and media data, on behalf of the respective operator. The operator remains responsible for ensuring an appropriate legal basis and transparent information towards data subjects for photos, event data and guest information.

9. BoothDock Gallery and private QR galleries

BoothDock Gallery provides private gallery links for customers and guests. This can involve processing photos, videos, thumbnails, file names, timestamps, event name, gallery code, download/release status, technical access data, IP address, browser information, and, where an operator enables such features, optional details voluntarily provided such as name or email address.

Galleries are designed as private links rather than publicly indexed collection pages. The legal basis for providing them to guests is generally determined by the respective operator. BoothDock generally processes this data as a data processor.

10. Billing, taxes and accounting

When BoothDock is used on a paid basis, invoicing, payment and contract data can be processed. This can include name, address, company, email address, scope of services, invoice numbers, payment status and tax-relevant information.

The legal bases are Art. 6(1)(b) GDPR for contract performance and Art. 6(1)(c) GDPR for statutory retention and documentation obligations.

11. Recipients and service providers

Personal data is only shared where necessary for operation, contract performance, support, security, billing or statutory obligations.

• IONOS SE for hosting, domains, SSL, email and infrastructure services.
• IONOS SE (AI Model Hub, Berlin data center) for the optional AI-assisted support chat - processes only the text of an entered chat message to generate an automatic reply.
• Cloudflare, Inc. for Turnstile bot protection on the contact form and support chat - checks the widget response, sets no tracking cookies and builds no user profiles.
• GitHub for source code management and deployment processes; productive event and media data is not intended to be stored there.
• Optional payment, support, monitoring or email service providers introduced later, where necessary for operation.
• Authorities, tax advisors or legal counsel, where legally required or necessary to enforce legal claims.
• Microsoft Ireland Operations Limited and Microsoft Corporation for the session recording with Microsoft Clarity – only if you have given consent (see section 4).

The optional AI support chat (on this website and in the BoothDock Hub) sends the text of an entered chat message to the IONOS AI Model Hub API (Berlin data center, EU) to generate an automatic reply. Only chat content is processed, never event, guest or media data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering inquiries quickly). The feature can be disabled centrally at any time.

12. Transfers to third countries

BoothDock is designed for EU-/Germany-centric processing. Under the target architecture, event and media data is not intended to be deliberately transferred to third countries outside the EU/EEA.

Where individual service providers process data outside the EU/EEA, or access from third countries cannot be excluded, this only occurs on the basis of appropriate safeguards, for example an adequacy decision, EU Standard Contractual Clauses, or comparable data protection mechanisms.

A deliberate transfer to the USA currently takes place only for the session recording with Microsoft Clarity described in section 4, and there only if you have given consent. Microsoft is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. Without your consent the service is not loaded, so no transfer takes place either.

13. Retention periods and deletion concept

Data is only retained for as long as necessary for the respective purpose or as required by statutory obligations.

• Website server logs: only for operation, security and error analysis; specific periods depend on the hosting setup.
• Contact and demo inquiries: until final processing, and afterwards as needed for follow-up questions or documentation obligations.
• Operator accounts and contract data: for the duration of the contract and afterwards according to statutory retention periods.
• Invoicing and accounting data: in accordance with statutory retention obligations.
• Event and media data: according to operator configuration; the aim is a clear expiry and deletion period per event/gallery.
• Backups: time-limited and not intended as a permanent archive for deleted event data.

14. Security and technical measures

BoothDock is operated with technical and organizational measures appropriate to the respective risk. In the target architecture, these include in particular TLS encryption, role-based access, private gallery links, separated operator areas, logging of security-relevant events, access restrictions for support, backups, deletion processes, and data-minimized logging.

Access to event or media data by BoothDock only occurs where necessary for operation, support, security, or upon the operator's instruction.

15. Automated decision-making

BoothDock does not make automated decisions within the meaning of Art. 22 GDPR and does not create profiling of guests, customers or operators.

16. Data subject rights

Data subjects have rights under the GDPR to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, that consent can be withdrawn at any time with effect for the future.

Requests can be sent to support@boothdock.eu. For event, guest or media data belonging to an operator, it may be necessary to forward the request to, or coordinate it with, the respective operator, since the operator is the controller for that processing.

17. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority. For the controller's location, the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia): https://www.ldi.nrw.de/.

18. Changes to this privacy notice

This privacy notice will be updated whenever features, service providers used, domains, retention periods or legal bases change. The current version is available at https://boothdock.eu/en/privacy/.